Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
35s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
20/10/2022, 22:26
Static task
static1
Behavioral task
behavioral1
Sample
3226dd4a887c464a11c9c66b2f2222014dc222a23a116cc8cba0488e1b0d278a.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
3226dd4a887c464a11c9c66b2f2222014dc222a23a116cc8cba0488e1b0d278a.exe
Resource
win10v2004-20220812-en
General
-
Target
3226dd4a887c464a11c9c66b2f2222014dc222a23a116cc8cba0488e1b0d278a.exe
-
Size
64KB
-
MD5
549fa0ed03135f321f9b3527329fc190
-
SHA1
ce6386a428e3d4ececed48c0367049f883bbc407
-
SHA256
3226dd4a887c464a11c9c66b2f2222014dc222a23a116cc8cba0488e1b0d278a
-
SHA512
62ea91370804c9c453c15f0a2587049b75c2bdd414eaed2d2782f97a84c9f1b7e5706e2c4673bee6defe2ee0ada055d1be8e19ee546e29ae8adc0895f2da6a70
-
SSDEEP
768:NQr04EpnIPz8v96hkbObBIEp0ocEnaLj8+IBfCylsCclAYbjxX2:NY044I78v96EEnaLj8bh+lv
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 1188 cmd.exe -
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum 3226dd4a887c464a11c9c66b2f2222014dc222a23a116cc8cba0488e1b0d278a.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 3226dd4a887c464a11c9c66b2f2222014dc222a23a116cc8cba0488e1b0d278a.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Enumerates processes with tasklist 1 TTPs 1 IoCs
pid Process 1832 tasklist.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1832 tasklist.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1940 3226dd4a887c464a11c9c66b2f2222014dc222a23a116cc8cba0488e1b0d278a.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1940 wrote to memory of 1188 1940 3226dd4a887c464a11c9c66b2f2222014dc222a23a116cc8cba0488e1b0d278a.exe 29 PID 1940 wrote to memory of 1188 1940 3226dd4a887c464a11c9c66b2f2222014dc222a23a116cc8cba0488e1b0d278a.exe 29 PID 1940 wrote to memory of 1188 1940 3226dd4a887c464a11c9c66b2f2222014dc222a23a116cc8cba0488e1b0d278a.exe 29 PID 1940 wrote to memory of 1188 1940 3226dd4a887c464a11c9c66b2f2222014dc222a23a116cc8cba0488e1b0d278a.exe 29 PID 1188 wrote to memory of 1832 1188 cmd.exe 31 PID 1188 wrote to memory of 1832 1188 cmd.exe 31 PID 1188 wrote to memory of 1832 1188 cmd.exe 31 PID 1188 wrote to memory of 1832 1188 cmd.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\3226dd4a887c464a11c9c66b2f2222014dc222a23a116cc8cba0488e1b0d278a.exe"C:\Users\Admin\AppData\Local\Temp\3226dd4a887c464a11c9c66b2f2222014dc222a23a116cc8cba0488e1b0d278a.exe"1⤵
- Maps connected drives based on registry
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1940 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c tasklist&&del 3226dd4a887c464a11c9c66b2f2222014dc222a23a116cc8cba0488e1b0d278a.exe2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:1188 -
C:\Windows\SysWOW64\tasklist.exetasklist3⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:1832
-
-